The European Union’s unveiling of a mobile app to check people’s age online has quickly turned sour, as cybersecurity experts found glaring privacy and security problems with the code.

Within hours of the EU’s app release, security consultant Paul Moore found it would store sensitive data on a user’s phone and leave it unprotected, he wrote in a widely shared post on X. Moore claimed to have hacked the app in under 2 minutes.

Baptiste Robert, a prominent French white hat hacker, confirmed many of the issues and told POLITICO it was possible to bypass the app’s biometric authentication features, meaning someone would be able to forgo entering a PIN code or using Touch ID to access the app.

For more details -

According to Moore, the app stores an encrypted PIN locally, but crucially, the encryption is not tied to the user’s identity vault, where sensitive verification data is kept.

That opens the door to a surprisingly simple bypass. By deleting specific values tied to the PIN from the app’s configuration files and restarting it, an attacker can set a new PIN while still retaining access to credentials created under the previous profile.

In effect, the app accepts reused identity data under a newly defined access control.

Moore also pointed to additional weaknesses that make brute-force or bypass attempts even easier.

Rate limiting, typically used to prevent repeated guessing of PINs, is stored as a simple counter in the same editable configuration file. Reset it to zero, and the system forgets how many attempts have already been made.

Biometric authentication, meanwhile, is controlled by a single boolean flag. Flip it from “true” to “false,” and the app simply skips biometric checks altogether.

The backlash quickly drew in high-profile voices, including Pavel Durov, co-founder and CEO of Telegram, who framed the incident as more than just a technical misstep.

In a post on his Telegram channel, Durov argued the app’s weaknesses may not be accidental.

“Their age verification app was hackable by design — it trusted the device,” he wrote, calling that “instant game over” from a security standpoint.

He went further, outlining what he suggested could be a broader trajectory for the project: first introducing a system marketed as privacy-friendly, then tightening controls after inevitable breaches.

“Present a ‘privacy-respecting’ but hackable app… get hacked… remove privacy to ‘fix’ the app,” he opined, describing the end result as “a surveillance tool sold as privacy-respecting.”

https://cybernews.com/security/eu-age-verification-app-hack/

Original Tweet - https://x.com/Paul_Reviews/status/2044723123287666921